View source for Test HTTP Strict Transport Security (OTG-CONFIG-007)

{{Template:OWASP Testing Guide v4}}


== Brief Summary ==
<br>
The HTTP Strict Transport Security (HSTS) header is a mechanism that web sites have to communicate to the web browsers that all traffic exchanged with a given domain must always be sent over https, this will help protect the information from being passed over unencrypted requests.<br>
Considering the importance of this security measure it is important to verify that the web site is using this HTTP header, in order to ensure that all the data travels encrypted from the web browser to the server.<br>
<br>
== Description of the Issue == 
<br>
...here: Short Description of the Issue: Topic and Explanation
<br>
== Black Box testing and example ==
'''Testing for the presence of HSTS header:''' <br>
    $ curl -s -D- <nowiki>https://paypal.com/</nowiki> | grep Strict
'''Result Expected:'''<br>
    Strict-Transport-Security: max-age=14400
== References ==
* OWASP HTTP Strict Transport Security - https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
* OWASP Appsec Tutorial Series - Episode 4: Strict Transport Security - http://www.youtube.com/watch?v=zEV3HOuM_Vw